Data Sharing with Advertising and Analytics Partners

What it is

Calendly shares your data with outside advertising and analytics companies, which may track your behavior across websites using cookies and similar tools.

Why it matters (compliance & governance perspective)

Data shared with advertising networks can be used to build detailed behavioral profiles about you, and this sharing may persist even after you stop using Calendly.

Consumer impact (what this means for users)

Your usage data and potentially your contact information may be shared with advertising and analytics vendors, enabling cross-site tracking and targeted advertising based on your Calendly activity.

What you can do

Institutional analysis (Compliance & governance intelligence)

REGULATORY LANDSCAPE: This provision engages the EU ePrivacy Directive and GDPR with respect to cookie consent requirements for EU/EEA users, and CPRA's opt-out of sharing provisions for California residents. The FTC Act's Section 5 unfair or deceptive practices authority is relevant to the adequacy of disclosure and consumer control mechanisms. Relevant enforcement authorities include EU supervisory authorities, the UK ICO, and the California Privacy Protection Agency. GOVERNANCE EXPOSURE: Medium. The disclosure of advertising data sharing is standard in consumer-facing platforms, but the breadth of third parties involved and the use of cross-site tracking technologies creates compliance exposure, particularly regarding the adequacy of cookie consent banners for EU/EEA users and the CPRA opt-out of sharing mechanism for California residents. JURISDICTION FLAGS: EU/EEA users require explicit consent for non-essential cookies under the ePrivacy Directive. California residents have a specific right to opt out of the sharing of personal information with third parties for cross-context behavioral advertising under CPRA. Organizations deploying Calendly for business use should assess whether their employees' or clients' data is subject to these sharing arrangements. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should identify which specific advertising and analytics vendors receive Calendly user data and assess whether those vendors' data practices are consistent with the organization's own privacy commitments. Sub-processor lists in any Calendly DPA should be reviewed for advertising technology vendors. COMPLIANCE CONSIDERATIONS: Organizations should verify that Calendly's cookie consent mechanisms meet the standard required in their operating jurisdictions. California-based users or organizations should confirm that opt-out of sharing mechanisms are functional and prominently disclosed. Data mapping should include advertising technology vendors as downstream recipients of scheduling platform data.

Applicable agencies

Applicable regulations

Provision details

Other risks in this policy

• Invitee Data Collection Without Account Creation high
• Calendar Content Processing medium
• International Data Transfers via Standard Contractual Clauses medium
• California Resident Privacy Rights (CCPA/CPRA) low
• Data Retention Without Specific Timeframes medium
• Legitimate Interests as Lawful Basis for Processing medium

Related Analysis

• Meta Removed 438 Sentences From Its Privacy Policy. Here Is What Disappeared.

  ConductAtlas detected a major restructuring of Meta’s privacy policy that removed detailed consumer rights disclosures and relocated them to separate documents.

• 23andMe Is Bankrupt. What Happens to Your DNA Now?

  Your genetic data may be transferred to a new owner as a business asset. Here is what the Terms of Service actually say and what you can do right now.